build: fall back to canonical Maven Central for releases the CI mirror lacks

Native verify 5037 failed solely because qbit-user-role-permissions 0.33.0-RC.1 (published
to Maven Central; HEAD repo.maven.apache.org 200) was not yet in the CI's Google-hosted
Central mirror (the same path returns 404 and the mirror's metadata omits the version).
The CI settings mirror only repository id "central" and Maven has no mirror failover.

Declare the canonical Central URL as a second, release-only repository with the id the
platform's own fallback profile uses (canonical-maven-central). It is tried only when
central misses; it adds no credential and no private or snapshot repository, and the
dependency version and every other pin are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -1,7 +0,0 @@
-name: build
-on:
-  push:
-jobs:
-  maven:
-    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
-    secrets: inherit

.gitea/workflows/qrun-release.yaml

@@ -0,0 +1,24 @@
+# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
+name: qrun-release
+on:
+  push: {}
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1
+    with:
+      runner: linux-small
+      browsers: true
+      browser-runner: browser-build
+  postpublish:
+    if: ${{ needs.release.outputs.capture == 'true' }}
+    needs: release
+    permissions:
+      contents: write
+      actions: write
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
+    with:
+      runner: linux-small

README.md

@@ -2,7 +2,7 @@
 
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-> **Status:** 0.1 release line, built on QQQ 4.1 (`4.1.0-RC.22`) and `qbit-user-role-permissions` `0.33.0-RC.1`. Published to the QRun-IO Gitea Maven registry only (`https://git.kof22.com/api/packages/QRun-IO/maven`); release candidates are `0.1.0-RC.N`.
+> **Status:** ⚠️ **Experimental / scaffold.** This qbit declares dependencies against `0.9999.0` sentinel versions of `qqq-backend-core` and `qqq-frontend-material-dashboard`, which means it does **not** consume a released framework version. Treat as exploratory until a maintainer confirms its intended state.
 
 QBit that aims to let qqq apps register **custom application screens** declaratively — pages built from widgets, forms, and table views — without writing dedicated front-end components.
 
@@ -27,15 +27,15 @@ src/main/java/com/kingsrook/qbits/customapps/
 
 ## How it relates to other qqq repos
 
-- **Declared dependencies:** `qqq-backend-core`, `qqq-middleware-api` (optional), `qqq-middleware-javalin`, `qbit-user-role-permissions`; test scope: `qqq-backend-module-rdbms`, `qqq-backend-module-postgres`. All versions come from the `qqq-bom-pom` import (`4.1.0-RC.22`).
+- **Declared dependencies:** `qqq-backend-core`, `qqq-backend-module-rdbms`, `qqq-frontend-material-dashboard`, `qqq-middleware-api`, `qqq-middleware-javalin` — all currently pinned to the `0.9999.0` sentinel version (development build).
 - **Inherits from:** `qbit-build-parent` (in the `qbit-bom` repo).
 - **Frontend pair:** Custom apps render via the standard qqq dashboard; no separate frontend component needed.
 
 ## Known gaps
 
-- Integration tests (`CustomAppsPostgresTest`) use a PostgreSQL Testcontainer, so building needs Docker.
-- Pre-1.0: the metadata and permission model may still change between release candidates.
-- Depends on QQQ 4.1 release candidates, so it is not yet pinned to a final QQQ 4.1.0.
+- No automated tests at the time this README was added.
+- Sentinel `0.9999.0` versions indicate this qbit is not currently consuming any released qqq build — meaning it can't be cleanly installed by a downstream app.
+- This README was added by an audit pass; original maintainer should verify intent and either pin to a real qqq version or mark the repo archived.
 
 ## License
 

pom.xml

@@ -23,21 +23,21 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
    <properties>
-      <revision>0.3.0-SNAPSHOT</revision>
+      <revision>0.1.0-SNAPSHOT</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
       <maven.compiler.showDeprecation>true</maven.compiler.showDeprecation>
       <maven.compiler.showWarnings>true</maven.compiler.showWarnings>
       <!-- jacoco sets argLine; the empty default keeps the UTC surefire argLine below valid when jacoco is not active -->
       <argLine></argLine>
-      <!-- qbit-user-role-permissions built for the QQQ 4.1 family: 0.33.0-RC.1, latest in the QRun-IO Gitea Maven registry. -->
-      <urp.version>0.33.0-RC.2</urp.version>
+      <!-- qbit-user-role-permissions built for the QQQ 4.1 family: 0.33.0-RC.1, read back from the canonical registry and on Maven Central (flattened POM, QQQ 4.1.0-RC.21). -->
+      <urp.version>0.33.0-RC.1</urp.version>
    </properties>
 
    <parent>
       <groupId>com.kingsrook</groupId>
       <artifactId>qbit-build-parent</artifactId>
-      <version>2.2.1</version>
+      <version>1.5.1</version>
    </parent>
 
    <groupId>com.kingsrook.qbits</groupId>
@@ -96,14 +96,30 @@
    </scm>
 
 
+   <repositories>
+      <!-- Canonical Maven Central as a fallback behind the CI's Google-hosted Central mirror (mirrorOf central only): a release published to
+           Central minutes ago can be absent from that mirror (404) and Maven never fails over between mirrors. A distinct id is not mirrored,
+           so it is tried when central misses. Same id and URL as the platform's own fallback profile; releases only, https, no credentials. -->
+      <repository>
+         <id>canonical-maven-central</id>
+         <url>https://repo.maven.apache.org/maven2/</url>
+         <releases>
+            <enabled>true</enabled>
+         </releases>
+         <snapshots>
+            <enabled>false</enabled>
+         </snapshots>
+      </repository>
+   </repositories>
+
    <dependencyManagement>
       <dependencies>
          <dependency>
             <groupId>com.kingsrook.qqq</groupId>
             <artifactId>qqq-bom-pom</artifactId>
             <!-- The LOCAL_WIDGET backend, per-session metadata customizer and restricted-permission code need the QQQ 4.1 family: the published core
-                 (QRun-IO Gitea Maven registry), the one BOM version shared by the four app-QBit patches. -->
-            <version>4.1.0-RC.25</version>
+                 (Central JAR/POM), the one BOM version shared by the four app-QBit patches. -->
+            <version>4.1.0-RC.21</version>
             <type>pom</type>
             <scope>import</scope>
          </dependency>